On December 7, 2023, the Court of Justice of the European Union (hereinafter referred to as the “CJEU”)ruled on a case arising from the existence of private databases of credit information agencies, in which data from public registers, especially regarding exemption from the remaining part of one’s debt, is recorded and stored. The issue disputed was that SCHUFA Holding AG kept them longer than the public registers.[1]

According to the code of conduct developed in Germany by the Association of Credit Information Agencies and approved by its supervisory authority, data is deleted only after three years from its registration pass. Meanwhile, German law, in connection with the content of Regulation (EU) 2015/848 of the European Parliament and of the Council of 20 May 2015 on insolvency proceedings, provides for a six-month deadline for deleting an entry in this regard.[2]

Processing of personal data, in the light of Art. 6 section 1, first paragraph, point f of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as “GDPR“, will be lawful if three conditions are cumulatively met:

1. there is a pursuit of a legitimate interest by the administrator or a third party,
2. there is a necessity to process the personal data to pursue this legitimate legal interest (so-called principle of data minimization)
3. there is a lack of priority for the interests or fundamental rights and freedoms of the person covered by data protection over the legitimate interest of the controller or a third party.

Despite the CJEU’s capability to guide on determining the existence of the above-mentioned conditions, it is ultimately left to the referring court to assess the specific main proceedings. Moreover, it is up to the referring court to balance the interests at stake and the consequences for the data subject. The case law of the CJEU shows that “the presence of the same personal data in several sources reinforces the interference with the individual’s right to privacy.” [3]

The institution of debt relief, as pointed out by the Advocate General,[4] is intended to enable a given person to participate in economic life again. However, empowering a credit reference agency to store personal data in its databases after it has been removed from the public register would defeat this purpose. Thus, “the considerable negative consequences … seem to override the commercial interest of the private agency and its clients.” [5]

Due to the abovementioned, the CJEU ruled that a decision on a complaint issued by a supervisory authority is subject to full judicial review. Moreover, it stated that Art. 5 section 1 letter a of GDPR in connection with Art. 6 section 1, first paragraph, point f of GDPR precludes the private credit reference agencies from storing in their databases information from the public register relating to the relief granted to natural persons from the remaining part of their debt for a period longer than that during which the data is stored in the public register.

Furthermore, according to the content of Art. 17 section 1 letters c and d of GDPR, the data subject has the right to request from the controller the immediate deletion of personal data concerning him or her when he or she objects to the processing following Art. 21 section 1 GDPR and there are no overriding legitimate grounds that could exceptionally justify the processing. The administrator is obliged to delete them without undue delay.

On the same day, the CJEU issued another ruling with the participation of SCHUFA Holding AG. It concerned the matter of scoring, which is an automated calculation of the probability of the ability to meet payment obligations in the future.[6] The case went to court because of the refusal to grant a loan by a third party after it was provided with negative information about the applicant established by the indicated private credit information office. Meanwhile, under Art. 22 section 1 of GDPR “the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.”

The CJEU stated that the calculation of a probability value based on personal data regarding the ability to meet payment obligations in the future constitutes an “automated decision-making in individual cases” within the meaning of Art. 22 section 1 of GDPR, if the establishment, performance, or termination of a contractual relationship by the third party to whom this probability value was communicated decisively depends on it. Accordingly, it is prohibited unless one of the exceptions provided in par. 2 of the Article applies.

Consecutively, the Member States cannot adopt provisions allowing profiling, which would violate the requirements from Art. 5 and 6 GDPR. What follows from the case law of the CJEU is that any processing of personal data should be consistent with the principles expressed in the above-mentioned provisions.

[1]Judgment of the Court (First Chamber) of 7 December 2023, Joined Cases C-26/22 and C-64/22, EU:C:2023:958.

[2]See § 9 section 1 Insolvenzordnung (Act on Bankruptcy Proceedings) of October 5, 1994 (BGBI. 1994 I, p. 2866) and § 3 Verordnung zu öffentlichen Bekanntmachungen in Insolvenzverfahren im Internet (Regulation on public notices on the Internet in insolvency proceedings) of 12 February 2002 ( BGBl . I, p. 677).

[3]Paragraph 100 of the judgment of the Court (First Chamber) of 7 December 2023, joined cases C-26/22 and C-64/22, EU:C:2023:958.

[4]Opinion of Advocate General Priit Pikamäe delivered on March 16, 2023 in joined cases C-26/22 and C-64/22 (hereinafter referred to as the ” Opinion“).

[5]Point 75 of the Opinion.

[6]Judgment of the Court (First Chamber) of 7 December 2023, C-634/21, EU:C:2023:957.